Don Wright Director of Standards Lexmark International don@lexmark.com P2600 Hardcopy Device and System Security September 2006 Working Group Meeting Don Wright Director of Standards Lexmark International don@lexmark.com 11/20/2018

Before you can score you must first have a goal ! -- anonymous 11/20/2018

Agenda Items Wednesday/Thursday, September 6-7 Welcome & Introductions Update and Approve Agenda Review and approve July Minutes IEEE Patent Policy Review 2006 Meeting Schedule 2007 Meeting Schedule Update on TCG Update on INCITS CS1 Working Group Review of Action Items from July Meeting Draft Commenting Tool 11/20/2018

Agenda Items Wednesday/Thursday, September 6-7 Topics from e-mail CC Vendors Forum update (Sukert) Korean Scheme (Wright) Command Injection (Sukert) PP-A versus PP-B Threats T.TSF.AUD.ACCESS and T.TSF.AUD.ALTER (Aubry) PP-B -- T.UD.SNIFF.NET and T.TSF.AUD.ACCESS (Aubry) Sample SFR for PP-C and CCV3.1 (Sukert) Top-down approach for generating SFRs (Smithson) Document Review of PPs & PP Annexes Merged Document Review Other items Next meeting details Summarize and record action items 11/20/2018

Minutes from July Meeting Minutes were published shortly after the meeting. They are available at: http://grouper.ieee.org/groups/2600/minutes/P2600-minutes-July2006.pdf Any corrections or changes? 11/20/2018

Instructions for the WG Chair At Each Meeting, the Working Group Chair shall: Show slides #1 and #2 of this presentation Advise the WG membership that: The IEEE’s patent policy is consistent with the ANSI patent policy and is described in Clause 6 of the IEEE-SA Standards Board Bylaws; Early disclosure of patents which may be essential for the use of standards under development is encouraged; Disclosures made of such patents may not be exhaustive of all patents that may be essential for the use of standards under development, and that neither the IEEE, the WG, nor the WG Chairman ensure the accuracy or completeness of any disclosure or whether any disclosure is of a patent that, in fact, may be essential for the use of standards under development. Instruct the WG Secretary to record in the minutes of the relevant WG meeting: That the foregoing advice was provided and the two slides were shown; That an opportunity was provided for WG members to identify or disclose patents that the WG member believes may be essential for the use of that standard; Any responses that were given, specifically the patents and patent applications that were identified (if any) and by whom. 11/20/2018 (Not necessary to be shown) Approved by IEEE-SA Standards Board – March 2003 (Revised March 2005)

IEEE-SA Standards Board Bylaws on Patents in Standards IEEE standards may include the known use of essential patents and patent applications provided the IEEE receives assurance from the patent holder or applicant with respect to patents whose infringement is, or in the case of patent applications, potential future infringement the applicant asserts will be, unavoidable in a compliant implementation of either mandatory or optional portions of the standard [essential patents]. This assurance shall be provided without coercion. The patent holder or applicant should provide this assurance as soon as reasonably feasible in the standards development process. This assurance shall be provided no later than the approval of the standard (or reaffirmation when a patent or patent application becomes known after initial approval of the standard). This assurance shall be either: a) A general disclaimer to the effect that the patentee will not enforce any of its present or future patent(s) whose use would be required to implement either mandatory or optional portions of the proposed IEEE standard against any person or entity complying with the standard; or b) A statement that a license for such implementation will be made available without compensation or under reasonable rates, with reasonable terms and conditions that are demonstrably free of any unfair discrimination. This assurance is irrevocable once submitted and accepted and shall apply, at a minimum, from the date of the standard's approval to the date of the standard's withdrawal. 11/20/2018 Slide #1 Approved by IEEE-SA Standards Board – March 2003 (Revised February 2006)

Inappropriate Topics for IEEE WG Meetings Don’t discuss the validity/essentiality of patents/patent claims Don’t discuss the cost of specific patent use Don’t discuss licensing terms or conditions Don’t discuss product pricing, territorial restrictions, or market share Don’t discuss ongoing litigation or threatened litigation Don’t be silent if inappropriate topics are discussed… do formally object. If you have questions, contact the IEEE-SA Standards Board Patent Committee Administrator at patcom@ieee.org or visit http://standards.ieee.org/board/pat/index.html This slide set is available at http://standards.ieee.org/board/pat/pat-slideset.ppt 11/20/2018 Slide #2 Approved by IEEE-SA Standards Board – March 2003 (Revised March 2005)

Officers No Change Chair: Don Wright, Lexmark Vice Chair: Lee Farrell, Canon Secretary: Brian Smithson, Ricoh Main Editors: Non-PP clauses: Jerry Thrasher, Lexmark PP clauses: Brian Smithson, Ricoh No Change 11/20/2018

2006 Meeting Schedule Oct. 23-24, Lexington KY @ Lexmark TCG on October 25 Also with PWG, FSG, OSDL Dec. 11-12, El Segundo, CA @ Peerless 11/20/2018

2007 Meeting Schedule Feb 21-22, Maui April 24-25 May 30-31 July 11-12 With PWG April 24-25 Suggest east coast US (look into IEEE-USA in DC) May 30-31 Handle comments from 1st re-circulation (if needed) Location open July 11-12 Handle comments from 2nd re-circulation (if needed) 11/20/2018

Trusted Computing Group Update 11/20/2018

INCITS CS1 : Cyber-Security Update 11/20/2018

Group General Action Items from July Update web site with future meeting details – complete Convert PP-A to CIM Medium @ EAL 3 – (due in July) – awaiting CCV3 drafts Harmonize Subject/Object implementation – (waiting for CCV3, part 2) 11/20/2018

Action Items from Previous Meetings Any update on CCV3 plans from NIAP? Benefits for paying for the PP evaluation (ideas) Company name/logo and acknowledgement of some kind on the PP cover sheets and/or on the PP certificate. Copyright license to freely use PP content. Joint press release or other PR activities with IEEE. Some kind of elevated acknowledgment (logos vs. no logo or whatever) on the P2600 standard. A discount from the eval lab for product evals based on P2600 PPs. A lab might like that to generate business. Only those contributing dollars have input into the selection of the eval lab, which PP’s get evaluated and the schedule/order of the PPs. Review entries in P2600-action-items excel spreadsheet Commenting Tool 11/20/2018

Issues raised on e-mail CC Vendors Forum update (Sukert) JBMIA Korean Scheme (Wright) Command Injection (Sukert) PP-A versus PP-B Threats T.TSF.AUD.ACCESS and T.TSF.AUD.ALTER (Aubry) Agree to leave both in PP-B (as well as PP-A) PP-B -- T.UD.SNIFF.NET (Aubry) Take T.UD.SNIFF.NET out of PP-B Sample SFR for PP-C and CCV3.1 (Sukert) Top-down approach for generating SFRs (Smithson) 11/20/2018

Document Section Status Editors Assigned: Clauses 1-9 & non-PP Annexes: Jerry Thrasher Protection Profiles: Brian Smithson PP-A -- Brian Smithson PP-B -- Ron Nevo PP-C -- Nancy Chen, Alan Sukert PP-D -- Carmen Aubry 11/20/2018

Document Review Drafts needing most review Merged Draft Clauses 8 & 9 Review Comments Received Protection Profiles A (version 22a) B (version 22a) C (version 22a) D (version 22a) PP Annex B (glossary) 11/20/2018

Document Review: PP-A Review Draft number 22a 11/20/2018

Document Review: PP-B Review Draft number 22a 11/20/2018

Document Review: PP-C Review Draft number 22a 11/20/2018

Document Review: PP-D Review Draft number 22a 11/20/2018

Other Work Items Which PPs to get evaluated? PP-A and PP-B highly likely to be evaluated PP-C on the bubble PP-D least likely to be evaluated Compliance/Conformance clause Products are required to be compliant with one or more of the protection profiles in Annexes A-D Other potentially required threat mitigations highlighted in Clause 8. Ron Nevo will create a strawman draft for the next meeting. 11/20/2018

Next Meeting Details October 23-24 Lexmark 740 New Circle Rd Building 082 Lexington, Ky 40550 Nearby Hotels: See http://grouper.ieee.org/groups/2600/meetings/lexington_hotel_info.htm Courtyard by Marriott 775 Newtown Court Lexington, KY 40511 859-253-4646 Lexmark 2006 rate = $89 Sheraton Four Points 1938 Stanton Way Lexington, KY 40511 859-259-1311 Lexmark 2006 rate = $65 PWG and PSG Details available from: http://www.pwg.org/chair/lexington06.html Embassy Suites 1801 Newtown Pike Lexington, KY 40511 859-455-5000 Lexmark 2006 rate = $99 Monday –Thursday, $129 weekends 11/20/2018

Next Meeting Location Map 11/20/2018

Future Meetings Note well: Lexington – expect 2 full days: 9AM – 6PM El Segundo – expect 2 full days: 9AM – 6PM 11/20/2018

Back-up Charts BACK-UP CHARTS 11/20/2018

Schedule Schedule Clauses 1-9, Informative Annex Protection Profiles Ready for merging May & June meeting reviews Protection Profiles Still Waiting for July draft of CCV3 into the PPs by Sept? PPs reviewed and iterate 1 or 2 times Complex changes: who knows? Complete draft out of December meeting 11/20/2018

Schedule Schedule January 2007 February March Form IEEE ballot body Engage with CC Eval Labs February Start Balloting Start Evaluation of PPs March April -- (Will need group meeting) Reconcile comments from IEEE and Eval Labs May – June - July Recirculations September RevCom / Standards Board Approval 11/20/2018

Mailing List and Web Site Listserv run by the IEEE An archive is available on the web site Subscribe via a note to: listserv@listserv.ieee.org containing the line: subscribe stds-2600 Only subscribers may send e-mail to the mailing list. No Change 11/20/2018